VPN: close the socket in protectVpn() to avoid leaking descriptors. (5779c9c2) · Commits · e / os / android_frameworks_base

core/java/android/net/IConnectivityManager.aidl

+1 −1

Original line number	Diff line number	Diff line
		@@ -100,7 +100,7 @@ interface IConnectivityManager

		void setDataDependency(int networkType, boolean met);

		void protectVpn(in ParcelFileDescriptor socket);
		boolean protectVpn(in ParcelFileDescriptor socket);

		boolean prepareVpn(String oldPackage, String newPackage);

+17 −15

Original line number	Diff line number	Diff line
		@@ -2528,8 +2528,23 @@ public class ConnectivityService extends IConnectivityManager.Stub {
		* @hide
		*/
		@Override
		public void protectVpn(ParcelFileDescriptor socket) {
		mVpn.protect(socket, getDefaultInterface());
		public boolean protectVpn(ParcelFileDescriptor socket) {
		try {
		int type = mActiveDefaultNetwork;
		if (ConnectivityManager.isNetworkTypeValid(type)) {
		mVpn.protect(socket, mNetTrackers[type].getLinkProperties().getInterfaceName());
		return true;
		}
		} catch (Exception e) {
		// ignore
		} finally {
		try {
		socket.close();
		} catch (Exception e) {
		// ignore
		}
		}
		return false;
		}

		/**
		@@ -2577,19 +2592,6 @@ public class ConnectivityService extends IConnectivityManager.Stub {
		return mVpn.getLegacyVpnInfo();
		}

		private String getDefaultInterface() {
		if (ConnectivityManager.isNetworkTypeValid(mActiveDefaultNetwork)) {
		NetworkStateTracker tracker = mNetTrackers[mActiveDefaultNetwork];
		if (tracker != null) {
		LinkProperties properties = tracker.getLinkProperties();
		if (properties != null) {
		return properties.getInterfaceName();
		}
		}
		}
		throw new IllegalStateException("No default interface");
		}

		/**
		* Callback for VPN subsystem. Currently VPN is not adapted to the service
		* through NetworkStateTracker since it works differently. For example, it

+3 −11

Original line number	Diff line number	Diff line
		@@ -70,22 +70,14 @@ public class Vpn extends INetworkManagementEventObserver.Stub {

		/**
		* Protect a socket from routing changes by binding it to the given
		* interface. The socket IS closed by this method.
		* interface. The socket is NOT closed by this method.
		*
		* @param socket The socket to be bound.
		* @param name The name of the interface.
		*/
		public void protect(ParcelFileDescriptor socket, String interfaze) {
		try {
		mContext.enforceCallingPermission(VPN, "protect");
		jniProtect(socket.getFd(), interfaze);
		} finally {
		try {
		socket.close();
		} catch (Exception e) {
		// ignore
		}
		}
		}

		/**